思科 ACI 多站点编排应用程序服务引擎部署身份验证绕过漏洞

攻击者可以利用此漏洞绕过身份验证，从而获得对 Cisco ACI Multi-Site Orchestrator 的未经授权访问。通过获取管理员级别的令牌，攻击者可以执行各种恶意操作，包括修改配置、窃取敏感数据、甚至完全控制受影响的设备。这种控制可能导致网络中断、数据泄露和严重的业务影响。由于该漏洞允许未经身份验证的访问，因此其潜在影响非常大，可能影响整个网络基础设施。类似于其他身份验证绕过漏洞，此漏洞可能被用于横向移动，进一步扩大攻击范围。

Organizations heavily reliant on Cisco ACI Multi-Site Orchestrator for network automation and management are at significant risk. Specifically, environments with exposed API endpoints or those lacking robust access controls are particularly vulnerable. Shared hosting environments utilizing ACI MSO could also be affected, as a compromised tenant could potentially exploit this vulnerability to gain access to other tenants' resources.

• linux / server: Monitor system logs (journalctl) for unusual API requests or authentication attempts. Look for patterns indicative of token manipulation.

journalctl -u aci-ms-orchestrator -f | grep -i "authentication bypass"

• cisco: Use Cisco's security monitoring tools to detect unauthorized API access attempts. Review Cisco Security Advisories for specific detection signatures. • generic web: Monitor network traffic for requests to the vulnerable API endpoint. Use intrusion detection systems (IDS) to identify suspicious patterns. • generic web: Check access logs for unusual user agent strings or IP addresses attempting to access the API endpoint.

1. 2021-02-24Disclosure

   disclosure

1. 已保留2020-11-13
2. 发布日期2021-02-24
3. 修改日期2024-11-08
4. EPSS 更新日期2026-04-02

由于受影响的版本范围未知，目前没有直接的升级修复方案。作为临时缓解措施，建议禁用或限制对受影响的 API 端点的访问。实施严格的访问控制策略，确保只有授权用户才能访问 MSO。此外，监控 API 端点的活动，以检测任何可疑行为。考虑使用 Web 应用防火墙 (WAF) 来过滤恶意请求。在升级到官方修复版本后，请验证令牌验证机制是否正常工作，以确保漏洞已成功修复。